Linux Kernel EUVD-2026-38944

Exploitation requires local access plus the privilege to create and update BPF maps (CAP_BPF/CAP_SYS_ADMIN, or a host with unprivileged BPF enabled - PR:L in the vector). The concrete trigger is creating a BPF_MAP_TYPE_CGROUP_STORAGE map (or another non-8-byte-rounded source such as skb->data) with a value_size that is NOT a multiple of 8 (e.g. 4 bytes), then updating a per-CPU map of the same value_size from it; an 8-byte-aligned value_size does not trigger the OOB. Limiting factors: the attacker must be local (no remote vector, AV:L), must hold BPF privileges, and the host must permit creating these specific map types - systems with kernel.unprivileged_bpf_disabled set and no delegated BPF capability are not exploitable by ordinary users. No user interaction is needed (UI:N).

Signals are internally consistent and point to a moderate, local-only issue rather than an urgent remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, base 7.1) requires local access and some privilege, with high confidentiality impact (kernel memory disclosure) and high availability impact (potential crash) but no integrity impact - matching an OOB read primitive. EPSS is very low at 0.16% (5th percentile), the CVE is not on CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of low complexity but mandatory local privileged BPF access means the realistic threat is privilege-bounded information disclosure (a useful building block for an exploit chain or KASLR/heap-leak rather than a standalone RCE). This is a real but non-emergency fix: prioritize for multi-tenant, container, and untrusted-local-code hosts where unprivileged or delegated BPF is reachable, and lower for single-tenant systems. No conflicting signals were observed; CVSS local vector aligns with the description's local map-update trigger.

A local attacker with the ability to load BPF programs (e.g. an unprivileged-BPF-enabled host or a container delegated CAP_BPF) creates a CGROUP_STORAGE map with a 4-byte value_size and a per-CPU map with the same value_size, then updates the per-CPU map using the storage map's element. The 8-byte-granularity copy reads 4 bytes past the source, leaking adjacent kernel memory back to the attacker (useful for defeating KASLR or harvesting secrets) or corrupting state enough to crash the host. No public POC is referenced, but the low attack complexity (AC:L) makes reliable reproduction straightforward for someone with the required local BPF access.